Everyone's still busy writing think pieces about GPT-4, so I want to talk about the OpenAI story that already got buried under it: the ChatGPT outage from last Monday, and the payment data mess that came with it.
Quick recap for anyone who missed it because they were too busy asking GPT-4 to pass the bar exam. On March 20th, OpenAI took ChatGPT offline for a few hours. At the time the explanation was vague, something about a bug causing people to see snippets of other users' chat history in their sidebar, which is unsettling enough on its own. I actually saw this myself before it went down, a chat title in my history that I definitely didn't write, sitting there like it belonged to me.
Then on Thursday OpenAI put out a proper writeup and it turned out to be worse than "you can see a stranger's chat titles." The bug was in an open-source Redis client library they use for caching, and during a specific nine-hour window it also exposed billing information for some ChatGPT Plus subscribers: names, email addresses, payment addresses, and the last four digits plus expiration date of credit cards. Not full card numbers, thankfully, but still the kind of thing that makes you want to go check your statement even when you logically know last-four-digits-plus-expiry isn't enough to actually charge anything.
I've been a Plus subscriber since early February (yes, I pay the $20 a month, no I don't feel great about it, more on that in a second) and I did not get one of the notification emails, so I apparently wasn't in the affected slice. But it rattled me more than it probably should have, honestly. Not because I think OpenAI is being careless in some sinister way, caching bugs happen, Redis client libraries are used by half the internet and nobody audits them line by line. It rattled me because of how fast this whole ecosystem is moving relative to how boring and slow good infrastructure practices are supposed to be. We went from "chatbot that writes limericks" to "chatbot holding your credit card on file" in about four months, and the plumbing underneath clearly hasn't caught up to the stakes.
The $20/month thing is its own minor complaint I'll shove in here since I'm already ranting: I only really use Plus during peak hours when the free tier gets capacity-limited and kicks me to GPT-3.5, and half the time even then I forget I'm paying for it until the receipt hits my inbox. I don't regret it exactly, GPT-4 access has been genuinely useful for debugging some gnarly regex this week, but it's the first SaaS subscription in years where I've caught myself asking "wait, what am I actually paying for again."
What I keep coming back to is that this is a company that, as of two weeks ago, was telling the world its models could pass professional exams and write functioning code from a napkin sketch, and it still has the same class of bug that's plagued basically every web app since caching was invented. That's not really a knock on OpenAI specifically, it's more a note to myself: the AI layer getting scarily capable doesn't mean the boring engineering underneath it graduated to scarily capable too. Those are two completely separate axes of "how good is this software," and it's easy to conflate them when the demo is impressive enough.
If you're a Plus subscriber and you're not sure whether you were in the affected window, OpenAI says they emailed everyone who was, so no email probably means you're fine, though I'd still keep an eye on the card statement for the next billing cycle regardless. And if you haven't already, this is as good a nudge as any to go turn on a virtual card number for subscriptions like this if your bank offers one. Mine does (Capital One's Eno thing) and I only started using it for stuff like this after a different, dumber leak a couple years back. Cheap insurance for two minutes of setup.
Anyway. Back to your regularly scheduled GPT-4 coverage, I'm sure there's plenty of it in your feed already.